Bug 1296660

Summary: RFE: audit of *at syscalls
Product: [Fedora] Fedora Reporter: Steve Grubb <sgrubb>
Component: kernelAssignee: Paul Moore <pmoore>
Status: CLOSED DEFERRED QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: medium    
Version: rawhideCC: gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda, mchehab, rbriggs
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-02 19:41:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Steve Grubb 2016-01-07 19:07:16 UTC 
Description of problem:
For the *at syscalls, can we get the path from the FD being passed as an argument to be able to reconstruct what is being accessed? (Readlink in /proc/<pid>/fds/# shows the path, why can't this go into the record? We may need a new auxiliary record type since this is neither the cwd or path.

This would be a big help since openat is used a lot.
Comment 1 Paul Moore 2016-01-12 16:57:30 UTC 
*** Bug 1296661 has been marked as a duplicate of this bug. ***
Comment 2 Paul Moore 2016-04-06 23:52:25 UTC 
Upstream issue:

 * https://github.com/linux-audit/audit-kernel/issues/9
Comment 3 Paul Moore 2016-06-02 19:41:47 UTC 
Closing this as we are tracking upstream RFEs on GitHub now, see the link in comment #2.